Skip to main content

LDAP with ASP.Net Identity Core in MVC with project.json

Lightweight Directory Access Protocol (LDAP), the name itself explain it. An application protocol used over an IP network to access the distributed directory information service.

The first and foremost thing is to add references for consuming LDAP. This has to be done by adding reference from Global Assembly Cache (GAC) into project.json

 "frameworks": {  
  "net461": {  
   "frameworkAssemblies": {  
    "System.DirectoryServices": "4.0.0.0",  
    "System.DirectoryServices.AccountManagement": "4.0.0.0"  
   }  
  }  
 },

These System.DirectoryServices and System.DirectoryServices.AccountManagement references are used to consume LDAP functionality.

It is always better to have an abstraction for irrelevant items in consuming part. For an example, the application does not need to know about PrincipalContext or any other dependent items from those two references to make it extensible. So, we can begin with some basic interface implementation which suits us.

 public interface IActiveDirectory<TUser>  
   where TUser : IdentityUser  
 {  
   /// <summary>  
   /// Finds the user by identity asynchronously.  
   /// </summary>  
   /// <param name="userId">The user id.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>User information.</returns>  
   Task<TUser> FindByIdentityAsync(string userId, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Gets the user roles asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>Roles for the user.</returns>  
   IList<string> GetUserRolesAsyc(string username, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="identity">The identity.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns><c>true</c>if user is authenticated;<c>false</c>for unauthorized user.</returns>  
   Task<bool> IsAuthenticatedAsync(IIdentity identity, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="password">The password.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns><c>true</c>if user is authenticated;<c>false</c>for unauthorized user.</returns>  
   Task<bool> IsAuthenticatedAsync(string username, string password, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Gets Authenticated user claim asynchronous.  
   /// </summary>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>Authenticated user claims.</returns>  
   Task<ClaimsIdentity> AuthenticatedUserClaimAsync(CancellationToken cancellationToken = default(CancellationToken));  
 }

It is just the basic structure, but can be modified based on need.

With this structure, we need to have a proper definition for each item and in that, we would using the added references.

 public sealed class ActiveDirectoryLdap  
   : IActiveDirectory<User>, IDisposable  // TODO: Actual model 

 {  
   //  
   /// <summary>  
   /// The principal context  
   /// </summary>  
   private readonly PrincipalContext PrincipalContext;  
   /// <summary>  
   /// Initializes a new instance of the <see cref="ActiveDirectoryLdap"/> class.  
   /// </summary>  
   /// <param name="principalContext">The principal context.</param>  
   public ActiveDirectoryLdap(PrincipalContext principalContext)  
   {  
     PrincipalContext = principalContext;  
   }  
   /// <summary>  
   /// Gets Authenticated user claim asynchronous.  
   /// </summary>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// Authenticated user claims.  
   /// </returns>  
   public Task<ClaimsIdentity> AuthenticatedUserClaimAsync(CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var user = UserPrincipal.Current;  
     if (user != null)  
     {  
       using (var adUser = UserPrincipal.FindByIdentity(PrincipalContext, user.Name))  
       {  
         if (adUser != null)  
         {  
           return Task.FromResult(CreateClaims(adUser));  
         }  
       }  
     }  
     return Task.FromResult(new ClaimsIdentity());  
   }  
   /// <summary>  
   /// Creates the claims as Active Directory User.  
   /// </summary>  
   /// <param name="user">The user.</param>  
   /// <returns>Claims for user.</returns>  
   private ClaimsIdentity CreateClaims(UserPrincipal user)  
   {  
     var identity = new ClaimsIdentity();  
     if (user != null)  
     {  
       identity.AddClaims(new[]  
       {  
         new Claim(ClaimTypes.Name, user.Name),  
         new Claim(ClaimTypes.Email, user.EmailAddress),  
         new Claim(ClaimTypes.NameIdentifier, user.Name),  
         new Claim(ClaimTypes.Name, user.DisplayName),  
         new Claim(ClaimTypes.GivenName, user.GivenName)  
       });  
     }  
     return identity;  
   }  
   /// <summary>  
   /// Finds the user by identity asynchronously.  
   /// </summary>  
   /// <param name="userId">The user id.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// User information.  
   /// </returns>  
   public Task<User> FindByIdentityAsync(string userId,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var directoryUser = UserPrincipal.FindByIdentity(PrincipalContext, userId);  
     if (directoryUser != null)  
     {  
       return Task.FromResult(new User 
       {  
         //Id = userId,  
         UserName = userId,  
         Email = directoryUser.EmailAddress,  
         //FirstName = directoryUser.GivenName,  
         //LastName = directoryUser.Surname,  
         //DisplayName = directoryUser.Name  
       });  
     }  
     return Task.FromResult<User>(null);  
   }  
   /// <summary>  
   /// Gets the user roles asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// Roles for the user.  
   /// </returns>  
   public IList<string> GetUserRolesAsyc(string username,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var rols = new List<string>();  
     if (IsUserInGroup(username, "viewer"))  
     {  
       rols.Add("viewer");  
     }  
     if (IsUserInGroup(username, "admin"))  
     {  
       rols.Add("admin");  
     }  
     return rols;  
   }  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="identity">The identity.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   ///  <c>true</c>if user is authenticated;<c>false</c>for unauthorized user.  
   /// </returns>  
   public Task<bool> IsAuthenticatedAsync(IIdentity identity,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var userPrincipal = UserPrincipal.FindByIdentity(PrincipalContext,  
                         IdentityType.SamAccountName,  
                         identity.Name);  
     return Task.FromResult(userPrincipal != null);  
   }  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="password">The password.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   ///  <c>true</c>if user is authenticated;<c>false</c>for unauthorized user.  
   /// </returns>  
   public Task<bool> IsAuthenticatedAsync(string username, string password,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     return Task.FromResult(PrincipalContext.ValidateCredentials(username, password));  
   }  
   /// <summary>  
   /// Determines whether specified user is in group.  
   /// </summary>  
   /// <param name="user">The user.</param>  
   /// <param name="group">The group.</param>  
   /// <returns><c>true</c>if user is in group;<c>false</c>for not in a group.</returns>  
   private bool IsUserInGroup(string user, string group)  
   {  
     bool found = false;  
     try  
     {  
       var gropPrincipal = GroupPrincipal.FindByIdentity(PrincipalContext, group);  
       var userPrincipal = UserPrincipal.FindByIdentity(PrincipalContext, IdentityType.SamAccountName, user);  
       if (gropPrincipal != null)  
       {  
         found = gropPrincipal.GetMembers(true)  
           .Contains(userPrincipal);  
       }  
     }  
     catch (Exception)  
     {  
       found = false;  
     }  
     return found;  
   }  
   #region " IDisposable "  
   /// <summary>  
   /// Disposed  
   /// </summary>  
   private bool disposed = false;  
   /// <summary>  
   /// Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.  
   /// </summary>  
   public void Dispose()  
   {  
     Dispose(true);  
     GC.SuppressFinalize(this);  
   }  
   /// <summary>  
   /// Releases unmanaged and - optionally - managed resources  
   /// </summary>  
   /// <param name="disposing"><c>true</c> to release both managed and unmanaged resources.</param>  
   private void Dispose(bool disposing)  
   {  
     if (!disposed)  
     {  
       if (disposing)  
       {  
         PrincipalContext.Dispose();  
       }  
     }  
     this.disposed = true;  
   }  
   #endregion " IDisposable "


Ideally, whenever a user visits they should be automatically allowed to log in. So for that, we would be customizing UserManager to create our own function and call on the login page.

 public class MyProjectUserManager  
   : UserManager<User>  
 {  
   /// <summary>  
   ///   The active directory  
   /// </summary>  
   private readonly IActiveDirectory<User> ActiveDirectory;  
   /// <summary>  
   ///   Gets a flag indicating whether the Active Directory is supported.  
   /// </summary>  
   public readonly bool SupportsActiveDirectory;  
   /// <summary>  
   ///   Initializes a new instance of the <see cref="MyProjectUserManager" /> class.  
   /// </summary>  
   /// <param name="store">The store.</param>  
   /// <param name="optionsAccessor">The options accessor.</param>  
   /// <param name="passwordHasher">The password hasher.</param>  
   /// <param name="userValidators">The user validators.</param>  
   /// <param name="passwordValidators">The password validators.</param>  
   /// <param name="keyNormalizer">The key normalizer.</param>  
   /// <param name="errors">The errors.</param>  
   /// <param name="services">The services.</param>  
   /// <param name="logger">The logger.</param>  
   /// <param name="activeDirectory">The active directory.</param>  
   public MyProjectUserManager(IUserStore<User> store, IOptions<IdentityOptions> optionsAccessor,  
     IPasswordHasher<User> passwordHasher, IEnumerable<IUserValidator<User>> userValidators,  
     IEnumerable<IPasswordValidator<User>> passwordValidators, ILookupNormalizer keyNormalizer,  
     IdentityErrorDescriber errors, IServiceProvider services, ILogger<UserManager<User>> logger,  
     IActiveDirectory<User> activeDirectory)  
     : base(store, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer,  
       errors, services, logger)  
   {  
     ActiveDirectory = activeDirectory;  
     SupportsActiveDirectory = activeDirectory != null;  
   }  
   /// <summary>  
   ///   Gets the Active Directory user claims.  
   /// </summary>  
   /// <returns></returns>  
   private async Task<ClaimsIdentity> GetAdUserClaims()  
   {  
     if (SupportsActiveDirectory)  
     {  
       return await ActiveDirectory.AuthenticatedUserClaimAsync();  
     }  
     var identity = new ClaimsIdentity();  
     return await Task.FromResult(identity);  
   }  
   /// <summary>  
   ///   Gets or create Active Directory user entry and returns same.  
   /// </summary>  
   /// <returns></returns>  
   public async Task<User> GetOrCreateAdUser()  
   {  
     var adUserClaim = await GetAdUserClaims();  
     //if (adUserClaim.IsAuthenticated && adUserClaim.Claims.Any())  
     if (adUserClaim.Claims.Any())  
     {  
       var availableUser = await FindByNameAsync(adUserClaim.Name);  
       if (availableUser != null)  
       {  
         return await Task.FromResult(availableUser);  
       }  
       var usr = new User  
       {  
         UserName = adUserClaim.FindFirst(c => c.Type == ClaimTypes.NameIdentifier).Value,  
         Email = adUserClaim.FindFirst(c => c.Type == ClaimTypes.Email).Value  
       };  
       var result = await CreateAsync(usr);  
       if (result.Succeeded)  
       {  
         var claimsRes = await AddClaimsAsync(usr, adUserClaim.Claims);  
         if (claimsRes.Succeeded)  
         {  
           return await Task.FromResult(usr);  
         }  
       }  
     }  
     return await Task.FromResult(default(User));  
   }  
 }

The function GetOrCreateAdUser needs to be called on Login Get Action. This would create an entry into AspNet Identity Core. Please mark that it is being used to create a direct user in AspNet Identity without providing a password. It can be also customized to allow as external login.

The Get request for Login action.

 [HttpGet]  
 [AllowAnonymous]  
 public Task<IActionResult> Login(string returnUrl = null)  
 {  
   var adUser = await UserManager.GetOrCreateAdUser();  
   if (adUser != null)  
   {  
     //SignInManager.ExternalLoginSignInAsync()  
     await SignInManager.SignInAsync(adUser, false, CookieAuthenticationDefaults.AuthenticationScheme);  
     return RedirectToLocal(returnUrl);  
   }  
   ViewData["ReturnUrl"] = returnUrl;  
   return View();  
 }

That is all we need to do, the final part is to setup dependency injection for IActiveDirectory under Startup.cs.

 services.AddScoped<IActiveDirectory<User>>(provider =>  
 {  
   try  
   {  
     var adServerPath = Configuration.GetSection("AppSettings").Get<string>("LdapUrl"); // From configuration  
     return new ActiveDirectoryLdap(new PrincipalContext(ContextType.Domain, adServerPath));  
   }  
   catch (PrincipalServerDownException) // Avoid LDAP if not available.  
   {  
   }  
 });



Labels:

Comments

Post a Comment

Popular posts from this blog

Using Redis distributed cache in dotnet core with helper extension methods

Redis cache is out process cache provider for a distributed environment. It is popular in Azure Cloud solution, but it also has a standalone application to operate upon in case of small enterprises application. How to install Redis Cache on a local machine? Redis can be used as a local cache server too on our local machines. At first install, Chocolatey https://chocolatey.org/ , to make installation of Redis easy. Also, the version under Chocolatey supports more commands and compatible with Official Cache package from Microsoft. After Chocolatey installation hit choco install redis-64 . Once the installation is done, we can start the server by running redis-server . Distributed Cache package and registration dotnet core provides IDistributedCache interface which can be overrided with our own implementation. That is one of the beauties of dotnet core, having DI implementation at heart of framework. There is already nuget package available to override IDistributedCache i...
3 comments
Read more

Data seed for the application with EF, MongoDB or any other ORM.

Most of ORMs has moved to Code first approach where everything is derived/initialized from codes rather than DB side. In this situation, it is better to set data through codes only. We would be looking through simple technique where we would be Seeding data through Codes. I would be using UnitOfWork and Repository pattern for implementing Data Seeding technique. This can be applied to any data source MongoDB, EF, or any other ORM or DB. Things we would be doing. - Creating a base class for easy usage. - Interface for Seed function for any future enhancements. - Individual seed classes. - Configuration to call all seeds. - AspNet core configuration to Seed data through Seed configuration. Creating a base class for easy usage public abstract class BaseSeed<TModel> where TModel : class { protected readonly IMyProjectUnitOfWork MyProjectUnitOfWork; public BaseSeed(IMyProjectUnitOfWork MyProjectUnitOfWork) { ...
Post a Comment
Read more

Centralized model validation both for MVC/WebApi and SPA client-side validation using FluentValidation

Validation is one of the crucial parts of any application. It has to validate on both client side and server side requests. What are target features or implementation from this article? Model validation for any given model. Centralized/One code for validation on both server-side and client-side. Automatic validation of model without writing any extra codes on/under actions for validation.  NO EXTRA/ANY codes on client-side to validate any form. Compatible with SPA. Can be compatible with any client-side validation framework/library. Like Angular Reactive form validation or any jquery validation libraries. Tools used in the implementation? FluentValidation : I feel DataAnnotation validation are excellent and simple to use, but in case of complex validation or writing any custom validations are always tricker and need to write a lot of codes to achieve whereas FluentValidations are simple even in case of complex validation. Generally, we need to validate inc...
2 comments
Read more

Architecture solution composting Repository Pattern, Unit Of Work, Dependency Injection, Factory Pattern and others

Project architecture is like garden, we plant the things in certain order and eventually they grow in similar manner. If things are planted well then they will all look(work) great and easier to manage. If they grow as cumbersome it would difficult to maintain and with time more problems would be happening in maintenance. There is no any fixed or known approach to decide project architecture and specially with Agile Methodology. In Agile Methodology, we cannot predict how our end products will look like similarly we cannot say a certain architecture will fit well for entire development lifespan for project. So, the best thing is to modify the architecture as per our application growth. I understand that it sounds good but will be far more problematic with actual development. If it is left as it is then more problems will arise with time. Just think about moving plant vs a full grown tree. Coming to technical side, In this article, I will be explaining about the various techniques ...
Post a Comment
Read more

Elegantly dealing with TimeZones in MVC Core / WebApi

In any new application handling TimeZone/DateTime is mostly least priority and generally, if someone is concerned then it would be handled by using DateTime.UtcNow on codes while creating current dates and converting incoming Date to UTC to save on servers. Basically, the process is followed by saving DateTime to UTC format in a database and keep converting data to native format based on user region or single region in the application's presentation layer. The above is tedious work and have to be followed religiously. If any developer misses out the manual conversion, then that area of code/view would not work. With newer frameworks, there are flexible ways to deal/intercept incoming or outgoing calls to simplify conversion of TimeZones. These are steps/process to achieve it. 1. Central code for storing user's state about TimeZone. Also, central code for conversion logic based on TimeZones. 2. Dependency injection for the above class to ...
4 comments
Read more

Trim text in MVC Core through Model Binder

Trimming text can be done on client side codes, but I believe it is most suitable on MVC Model Binder since it would be at one place on infrastructure level which would be free from any manual intervention of developer. This would allow every post request to be processed and converted to a trimmed string. Let us start by creating Model binder using Microsoft.AspNetCore.Mvc.ModelBinding; using System; using System.Threading.Tasks; public class TrimmingModelBinder : IModelBinder { private readonly IModelBinder FallbackBinder; public TrimmingModelBinder(IModelBinder fallbackBinder) { FallbackBinder = fallbackBinder ?? throw new ArgumentNullException(nameof(fallbackBinder)); } public Task BindModelAsync(ModelBindingContext bindingContext) { if (bindingContext == null) { throw new ArgumentNullException(nameof(bindingContext)); } var valueProviderResult = bindingContext.ValueProvider.GetValue(bin...
2 comments
Read more

Custom authorization on class, action/function, code, area level under Asp.Net MVC application

With evolution of ASP.Net MVC there are lot of inbuilt feature came and evolved with time. One of those is Authorization and Custom Authorization. The in-built function is sufficient enough to handle anonymous user restriction, user based on there name, specific roles for user with just single class AuthorizeAttribute . To implement we need to decorate attribute on any given class, action based on need. Example: [Authorize] public ActionResult Test() { } By just providing  Authorize  attribute anonymous user are restricted. It has Roles  and Users  property parameters to restrict access based on certain role or user which can accept multiple values by comma separated as string format. In one of the situation, I got chance to built an authorization where roles keep changing. Administrator can add new role, delete any role or modify existing role. In that situation we cannot map roles with codes. So, there were two way to achieve by creating group ...
Post a Comment
Read more

Global exception handling and custom logging in AspNet Core with MongoDB

In this, we would be looking into logging and global exception handling in the AspNet Core application with proper registration of logger and global exception handling. Custom logging The first step is to create a data model that we want to save into DB. Error log Data model These are few properties to do logging which could be extended or reduced based on need. public class ErrorLog { /// <summary> /// Gets or sets the Error log identifier. /// </summary> /// <value> /// The Error log identifier. /// </value> [BsonRepresentation(BsonType.ObjectId)] public ObjectId Id { get; set; /// <summary> /// Gets or sets the date. /// </summary> /// <value> /// The date. /// </value> public DateTime Date { get; set; } /// <summary> /// Gets or sets the thread. /// </summary> ...
1 comment
Read more

Storing and restoring Kendo Grid state from Database

There is no any built in way to store entire grid state into database and restore back again with all filters, groups, aggregates, page and page size. At first, I was trying to restore only filters by looking through DataSourceRequest. DataSourceRequest is kind of communication medium between client and server for the operation we do on grid. All the request comes via DataSourceRequest. In previous approach, I was trying to store IFileDescriptor interface which come with class FileDescriptor by looping through filters and serializing into string for saving into database but this IFileDescriptor can also contain CompositeFilterDescriptor which can be nested in nested object which are very tricky to handle. So, I had decompiled entire Kendo.MVC library and found out that all Kendo MVC controls are derived from “JsonObject”. It is there own implementation with ”Serialize” abstract function and “ToJson” function. In controls they are overriding “Serialize” method which depicts t...
Post a Comment
Read more

main method return value

Mainly we used to write "static void main" for entry point in console application. Placement of void denotes return type. In main function we could have "int" too but what does it really mean. "int main" signifies return type as integer. The return type of main function tells about execution status of application. Even if we have specified void as return type then it would be marked as successful program execution. If we mark int as return type then we are able to control the execution status. Now, what is the benefit of making main function as int. Windows OS saves result in  %ERRORLEVEL% environment variable of OS. If we create batch file and execute application through it then we will able to get status and based on result we can trigger something else through batch file. Let's suppose we have created program called TEST.EXE. Batch file script: @echo off REM Execute main program REM TEST.EXE @if  "%ERRORLEVEL%" == "0...
Post a Comment
Read more